Virus. A program that recursively replicates a possibly evolved copy of itself.

Payload

Behaviour

Description

WormAutorun

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

IRCBot

A bot can communicate with command and control servers via IRC channel.

UDPFlooder

This program can make a UDP flood. A UDP flood attack is a denial-of-service attack using the User Datagram Protocol (UDP). It can be initiated by sending a large number of UDP packets to random ports on a remote host.

USBInfector

A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.

Process activity

The Virus creates the following process(es):

Lskmkx.exe:312%original file name%.exe:616

The Virus injects its code into the following process(es):
No processes have been created.

File activity

The process %original file name%.exe:616 makes changes in the file system.The Virus creates and/or writes to the following file(s):

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.
A program can register a device notification with the help of RegisterDeviceNotification. So it is notified when a USB device is plugged and then the worm copies itself to the USB device plugged into the affected computer.